Permissions, Privileges, and Access Controls in Fedora - CVE-2015-0278

Vulnerability identifier: #VU40789

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2015-0278

CWE-ID: CWE-264

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

libuv before 0.10.34 does not properly drop group privileges, which allows context-dependent attackers to gain privileges via unspecified vectors.

Fedora
Gentoo Linux
libuv
compat-libuv010
nodejs
v8

Install update from vendor's website.

libuv - addressed in versions 0.10.34-1.el6, 0.10.34-1.el7, 0.10.34-1.fc21
compat-libuv010 - update to 0.10.34-1.fc22
nodejs - addressed in versions 0.10.36-3.el6, 0.10.36-3.el7, 0.10.36-3.fc21
v8 - addressed in versions 3.14.5.10-17.el6, 3.14.5.10-17.el7, 3.14.5.10-17.fc21

• http://advisories.mageia.org/MGASA-2015-0186.html
• http://www.mandriva.com/security/advisories?name=MDVSA-2015:228
• https://github.com/libuv/libuv/commit/66ab38918c911bcff025562cf06237d7fedaba0c
• https://github.com/libuv/libuv/pull/215
• https://groups.google.com/forum/#!msg/libuv/0JZxwLMtsMI/jraczskYWWQJ
• https://lists.fedoraproject.org/pipermail/package-announce/2015-February/150526.html
• https://security.gentoo.org/glsa/201611-10

• Permissions, Privileges, and Access Controls in Fedoraproject Fedora
• Gentoo update for libuv
• Fedora 21 update for libuv, nodejs, v8
• Fedora EPEL 7 update for libuv, nodejs, v8
• Fedora EPEL 6 update for libuv, nodejs, v8
• Fedora 22 update for compat-libuv010